From Venezuela to Spain and Miami: An entrepreneur’s path into global crime
When Leonardo Rafael Montbrun Álvarez began promoting his fintech startup in 2019 in Miami, he presented himself as a young Venezuelan entrepreneur offering a technological lifeline to people shut out of the global financial system. His company, Shasta, promised fast, low-cost digital transfers, access to international payments and a modern alternative to traditional banking for Latin Americans living under strict currency controls.
Five years later, Montbrun’s name appears in a sweeping U.S. federal indictment alleging his involvement in a complex transnational criminal conspiracy — a case that intertwines cybercrime, money laundering and a Venezuelan criminal organization designated by the United States as a foreign terrorist group.
Montbrun, 37, appeared before U.S. Magistrate Judge Lauren F. Louis in the Southern District of Florida on December 18, following his arrest earlier that week. Prosecutors moved to unseal the indictment, a request the court granted, formally making the charges public. He is accused of participating in a conspiracy involving financial crimes and the provision of material support to terrorist activity — offenses that carry severe federal penalties. The judge ordered that Montbrun remain in custody pending further proceedings.
According to the unsealed indictment, Montbrun Álvarez and more than a dozen co-defendants allegedly operated a sophisticated transnational criminal network that stole millions of dollars from U.S. banks through high-tech ATM attacks, laundering the proceeds through an international financial scheme tied to a designated terrorist organization.
Court documents filed in the U.S. District Court for the District of Nebraska describe a sprawling conspiracy linked to Venezuela’s Tren de Aragua, a criminal organization that originated inside the country’s prison system and later expanded across the Americas. The group was formally designated a Foreign Terrorist Organization by the U.S. government in February 2025.
Prosecutors allege that between early 2024 and late 2025, the defendants carried out dozens of so-called “ATM jackpotting” attacks across multiple states, targeting financial institutions in Nebraska and beyond. The scheme is believed to have caused more than $5.4 million in confirmed losses, with an additional $1.4 million in attempted thefts.
According to the indictment, the group used specialized malware to compromise ATMs and force them to dispense cash on command. The attacks typically began with surveillance of targeted machines, followed by physical access to internal components. Using laptops or compact devices such as Raspberry Pi units, the suspects allegedly installed malicious software that bypassed security systems and allowed them to empty the machines remotely.
Prosecutors say the malware was designed to erase itself after each operation, complicating forensic analysis and enabling the group to replicate the scheme across multiple jurisdictions. Stolen funds were then transported, laundered through shell transactions or moved across borders to conceal their origin.
In total, authorities allege the network carried out or attempted more than 100 jackpotting attacks against banks and credit unions insured by the Federal Deposit Insurance Corporation and the National Credit Union Administration.
The indictment names more than 20 defendants from Venezuela and other Latin American countries, including Aníbal Alexander Canelón Aguirre — also known as “Prometheus” or “The Engineer” — who is described as holding a key technical or leadership role within the organization. Prosecutors say the group operated across Venezuela, Colombia, Mexico, Spain and the United States, with members assigned specialized roles ranging from cyber intrusion and logistics to cash collection and money laundering. This division of labor, investigators allege, allowed the network to operate efficiently while minimizing detection.
If convicted, the defendants face lengthy federal prison sentences.
The charges brought in Miami represent the latest chapter in a longer story surrounding Montbrun. Well before U.S. authorities intervened, financial watchdogs in multiple jurisdictions had begun probing the operations of Shasta, the company the Venezuelan businessman had been promoting in South Florida.
Shasta emerged in 2019 as a digital payments platform marketed to users across Latin America and Europe. In press releases, Montbrun and his partners portrayed the company as a tool to “democratize finance,” offering mobile wallets, peer-to-peer transfers and prepaid cards for people excluded from traditional banking systems.
The company claimed it quickly attracted thousands of users and expanded into multiple jurisdictions. Promotional materials emphasized compliance, security and partnerships with international financial institutions. For many Venezuelans struggling with inflation and capital controls, Shasta appeared to offer a rare gateway to the global financial system.
Behind the scenes, however, regulators and investigators were already taking notice.
In August 2021, Venezuelan financial authorities moved abruptly against the company. The country’s banking regulator, SUDEBAN, ordered administrative measures that effectively shut down Shasta’s operations. The company was accused of serious regulatory violations and user accounts were frozen.
That same month, Spanish national Alex Sicart, a co-founder of Shasta, was detained in Caracas on charges including fraud, money laundering and criminal association. His arrest marked the first public indication that authorities viewed the platform not merely as a failed startup, but as a potential criminal enterprise.
As Shasta collapsed, users were instructed to recover remaining balances through the state-run Banco Nacional de Crédito. Many reported difficulties accessing their funds; others claimed their money had disappeared entirely.
While Venezuelan authorities took initial action, investigators in Spain were also scrutinizing Shasta’s operations. Spanish media later reported that financial intelligence units had flagged the platform for suspected money laundering and improper cross-border transfers.
Those investigations focused in part on Leonardo Montbrun and his alleged business partners, including individuals connected to a web of shell companies in Spain and Venezuela. Among the most explosive allegations was that the platform had been used to move funds on behalf of politically connected figures, including members of Venezuela’s military elite.
According to reporting by the Spanish outlet Moncloa.com, one of the figures linked to the operation was Vivian Arlet Ruiz Barrera, identified as the partner of Venezuelan Defense Minister Vladimir Padrino López. She was reportedly listed as a shareholder or director in several companies tied to Shasta. The report alleged that her political connections were used to attract clients and shield the operation from scrutiny.
Spanish media also reported that dozens of Venezuelan military officers moved money through the platform in hopes of transferring assets abroad. Many allegedly declined to file formal complaints after the platform collapsed, fearing retaliation or exposure of their own financial dealings.
Neither Padrino López nor his representatives have publicly commented on the allegations, and no formal charges have been announced against him in connection with the case.
